#pragma once

enum cls_protocol
{
	cls_nop,
	cls_get_system_time,
	cls_add_ignore_pid,
	cls_add_ignore_file,
	cls_get_process_path,
	cls_get_image_path,
	cls_get_parent_pid,
	cls_get_process_createtime,
	cls_get_process_baseinfo,
	cls_set_capture,
};

enum svc_protocol
{
	svc_nop,
	svc_ps_create_process,
	svc_ps_load_image,
	svc_nt_load_driver,
	svc_nt_query_systeminfo,
	svc_nt_open_process,
	svc_nt_terminate_process,	
	svc_nt_read_virtual_mem,
	svc_nt_write_virtual_mem,
	svc_fs_create_file,
	svc_fs_close_file,
};

#pragma pack(1)

typedef struct
{
	ULONG txsb;
	UCHAR ver;
}conn_context_data;

typedef struct
{
	UCHAR protocol;
	ULONG ProcessId;
}cls_pid_data;

typedef struct
{
	UCHAR protocol;
	USHORT Length;
	WCHAR Buffer[0];
}cls_file_data;

typedef struct
{
	UCHAR protocol;
	ULONG ProcessId;
	ULONG64 ImageBase;
}cls_get_image_path_data;

typedef struct
{
	ULONG ParentProcessId;
	ULONGLONG CreateTime;
	BOOLEAN Is64Bit;
	ULONG SessionId;
	WCHAR ImagePath[260];
}cls_get_process_baseinfo_data;

typedef struct
{
	UCHAR protocol;
	ULONG Capture;
}cls_set_capture_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
}svc_nop_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	BOOLEAN Create;
	ULONG ProcessId;
	ULONG ParentProcessId;
	ULONGLONG CreateTime;
	BOOLEAN Is64Bit;
	ULONG SessionId;
	WCHAR ImagePath[260];
}svc_ps_create_process_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG64 ImageBase;
	ULONG64 ImageSize;
	WCHAR ImagePath[260];
}svc_ps_load_image_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG QueryClass;
}svc_nt_query_systeminfo_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG TargetProcessId;
	ULONG ResultStatus;
}svc_nt_terminate_process_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG TargetProcessId;
	ULONG DesiredAccess;
	ULONG ResultStatus;
}svc_nt_open_process_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG TargetProcessId;
	ULONG64 BaseAddress;
	ULONG64 BufferSize;
	ULONG ResultStatus;
}svc_nt_read_virtual_mem_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG TargetProcessId;
	ULONG64 BaseAddress;
	ULONG64 BufferSize;
	ULONG ResultStatus;
}svc_nt_write_virtual_mem_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG ResultStatus;
	WCHAR RegisterPath[260];
	WCHAR ImagePath[260];
}svc_nt_load_driver_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG DesiredAccess;
	ULONG Disposition;
	ULONG Options;
	ULONG ShareAccess;
	ULONG Attributes;
	ULONG ResultStatus;
	WCHAR FilePath[260];
}svc_fs_create_file_data;

typedef struct
{
	UCHAR protocol;
	ULONG size;
	ULONG64 time;
	ULONG ProcessId;
	ULONG ResultStatus;
	WCHAR FilePath[260];
}svc_fs_close_file_data;

#pragma pack()